fix(import): close the append path check and the relocate overwrite

static/app.js

@@ -42,10 +42,11 @@ function toast(msg, isError = false) {
   setTimeout(() => (t.hidden = true), 4000);
 }
 
+// quotes included: the result also lands inside attributes (value="${esc(...)}")
+const ESC_CHARS = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
+
 function esc(s) {
-  const d = document.createElement("div");
-  d.textContent = s ?? "";
-  return d.innerHTML;
+  return String(s ?? "").replace(/[&<>"']/g, (c) => ESC_CHARS[c]);
 }
 
 // last used library per media type
@@ -1040,7 +1041,8 @@ $("#import-merge").addEventListener("click", () => {
   const name =
     commonPrefix(chosen.map((it) => it.name)) || parentName || chosen[0].name;
   const merged = {
-    path: chosen[0].path.slice(0, chosen[0].path.length - chosen[0].name.length - 1) || chosen[0].path,
+    path: chosen[0].dir || chosen[0].path,
+    dir: chosen[0].dir,
     name,
     rel_dir: chosen[0].rel_dir,
     media_type: chosen[0].media_type,
@@ -1398,6 +1400,12 @@ async function collapseSharedRequests(chosen) {
 
 // deepest folder that holds all of the group's entries
 function sharedParent(group) {
+  // base64 paths carry no readable separators, so only the scanner's own
+  // parent dir says anything about them
+  if (group.some((it) => it.path.startsWith("b64:"))) {
+    const dirs = new Set(group.map((it) => it.dir));
+    return dirs.size === 1 ? group[0].dir : group[0].path;
+  }
   const parts = group.map((it) => it.path.split("/"));
   const first = parts[0];
   let i = 0;